Dashboards & Visualizations

Set subsearch at a different time range than main search

kkas
Path Finder

example: search sourcetype=A [search sourcetype=B|dedup derp|fields derp|rename derp as Network_ID]|dedup CLIENT_IP|fields CLIENT_IP|table CLIENT_IP

My inner subsearch needs a wide time range (30 days) to get all the events I'm looking for while the outer search only needs 1 day. If I set the search for last 30 days the outer search takes forever. Is there a way to have the inner search scan for last 30 days, and outer search scan for 1 day?

Tags (1)

woodcock
Esteemed Legend

Try this with your timepicker set to last 24 hours (or however you specify 1 day)

search sourcetype=A [search earliest=-30d@d latest=now sourcetype=B|dedup derp|fields derp|rename derp as Network_ID]|dedup CLIENT_IP|fields CLIENT_IP|table CLIENT_IP

zd00191
Communicator

Is it possible to do this and have the subsearch be an overlay to a column chart or line chart?

0 Karma

woodcock
Esteemed Legend

Yes, do it like this:

MyFirstSearchHere | chart STUFF | append [search earliest=-30d@d latest=now MySecondSearchHere | chart STUFF]
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...